refactor(plugin): add wide Windows candidate file operations

[kmbroai]

Summary

Add the Windows file operations needed by candidate normalization through the existing native handle binding. Use native filesystem behavior and retain raw UTF-16 paths without recreating Python path semantics.

Changes

• Add typed file reads, exclusive iterable writes, replacement, and deletion with one shared handle-cleanup helper.
• Resolve existing paths through native final paths and missing outputs through their nearest existing ancestor.
• Delegate Windows drive/UNC parsing, scope joining, and home path operations to node:path.win32; pass native-prefixed and other-drive relative scopes to the OS.
• Keep native device prefixes. Join policy scopes before restoring the prefix so ordinary root and same-drive relative scopes remain valid. Propagate dangling-link, access, and sharing errors.
• Remove custom path normalization, prefix rewriting, link-target traversal, and the unnecessary native readlink API.
• Keep tests for raw paths, missing ancestors, short I/O, exclusive creation, failed writes, and cleanup; remove Python-specific path fixtures.
• Incorporate main through bc70facbecec7beb7d5fd8a85c543c86d833ca5a.

Testing

• Windows adapter tests and focused policy-helper checks passed; Windows-only policy cases are covered by hosted CI.
• Source-function probes cover drive roots, UNC, raw UTF-16, alternate data streams, native prefixes, and ordinary scope joining.
• Ruff source and format checks, SDK CI compilation, SDK/MCP types, full formatting, plugin source compatibility, and all nine source-checker tests passed.
• Generated TypeScript outputs were rebuilt; native Rust source is unchanged by the latest path simplification.
• Three independent native reviews and a separate verifier completed before publication.
• The Windows native proof and full platform matrix run in the PR checks.

Risk and rollout

This is the prerequisite for #837. Strict resolution remains the default; callers independently validate containment. Non-strict resolution supports missing ordinary outputs, but no longer follows dangling links or emulates Python's device-name, whitespace, verbatim-dot, or prefix-removal quirks. Native paths can retain their device prefix. Public commands, flags, and defaults are unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-29T18:12:45.267945Z	e9da224	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Critical review with GPT-6 Astra at ultra

Reviewed 06112a516431a9e12de644e8621b0176946da0a5 against merge base b39e2457b317f619ff9b14f96a7b2415703866be, after the combined-stack QA.

No additional inline finding survived validation. The native file operations are a useful prerequisite for the helper migration: raw Windows paths, exclusive writes, replacement and cleanup have concrete consumers. The duplicate windowsParts/windowsJoin implementation has been removed, satisfying the earlier parser comment.

The main simplification target remains the non-strict resolver's broad Python error policy. That discussion needs two corrections:

• The original denied-open example is rejected by the actual downstream file-identity check. I verified this through the normalization command, so that example does not demonstrate accepted containment.
• Missing output files and rank-directory comparisons also use non-strict resolution. Preserve those workflows and deliberate dangling-output-link behavior when narrowing the tolerated errors; deleted inventory is not the entire contract.

Focus the follow-up on replacing the generic 15-error whitelist with a defined missing-path contract and propagating opaque lookup failures. A separate mocked final-name-failure case still accepts an unresolved row, but this has not been demonstrated as a real Windows boundary bypass. Keep that evidence distinction in the existing thread.

Targeted verification: 24 adapter tests, 34 policy/launcher tests, 15 independent I/O/consumer checks and 9 portable-checker tests passed; five Windows-only tests skipped on Linux. I independently replayed the seven consumer assertions. Plugin build, MCP/CI-tool types, portable source and Ruff checks passed. Initial fixture failures reproduced on main and passed after correcting the fixture environment.

Exact-head hosted Windows/macOS CI, including Windows native and PowerShell checks, was inspected. Local Windows behavior was modeled. The combined-tree platform gap is documented in the shared QA comment.

[kmbroai]

Addressed the general review and both inline threads. The duplicate Windows parser is already removed. I retained the non-strict resolver for the missing-output, directory-comparison, and dangling-output-link contracts described in the follow-up, and recorded that the denied-open example is rejected by the downstream identity check; the mocked final-name case is not evidence of a real Windows boundary bypass. Both threads have replies and are resolved.

Updated head: 06112a516431a9e12de644e8621b0176946da0a5. Hosted CI passes on this head, including Linux/macOS/Windows tests, native proofs, installed-package checks, plugin source contracts, types, and formatting. Codex Security Review also passes. The combined stack at 5bd1d1909ad99d2749fe8d3ec49a9a144ae2bac0 includes this head and has also passed platform CI.